release: conexus 7.36.1

.claude-plugin/marketplace.json

@@ -11,21 +11,21 @@
         "source": "git-subdir",
         "url": "https://github.com/Hellblazer/nexus.git",
         "path": "conexus",
-        "ref": "v7.36.0"
+        "ref": "v7.36.1"
       },
       "description": "Self-hosted three-tier knowledge management with 13 specialized agents, plan-centric retrieval via nx_answer, semantic search, and RDR decision tracking for Claude Code.",
-      "version": "7.36.0"
+      "version": "7.36.1"
     },
     {
       "name": "sn",
       "source": {
         "source": "git-subdir",
         "url": "https://github.com/Hellblazer/nexus.git",
         "path": "sn",
-        "ref": "v7.36.0"
+        "ref": "v7.36.1"
       },
       "description": "Injects Serena and Context7 MCP tool usage guidance into subagents via SubagentStart hook.",
-      "version": "7.36.0"
+      "version": "7.36.1"
     }
   ]
 }

.claude/skills/release/SKILL.md

@@ -218,7 +218,7 @@ CI enforces parity. Missing any one of these fails the marketplace-version-match
 
 Optional but recommended: also bump `plugins[].source.sha` to the 40-char SHA of the release commit, for protection against tag force-push. Add post-commit (Step 8a, see below).
 
-**Engine-service pin (conditional 8th target — nexus-3rq00).** The Python/Java boundary rides one more hand-edited constant that sits OUTSIDE the seven-manifest parity gate: `PINNED_SERVICE_TAG` in `src/nexus/daemon/binary_install.py`, the `engine-service-vX.Y.Z` release this build auto-installs. It is DERIVED from `REQUIRED_ENGINE_VERSION`, so it is never hand-edited: moving the engine identity moves the pin by construction. Two invariants the `TestEnginePinParity` test enforces: (1) `PINNED_SERVICE_TAG`'s numeric version must be `>= REQUIRED_ENGINE_VERSION` (`src/nexus/engine_version.py`) — never ship a client that auto-installs an engine it then refuses as too old; (2) at the 6.0 release boundary the pin must be non-None (it is intentionally `None` pre-6.0). A release that bumps pyproject to 6.x without setting a real pin trips CI. **The pin's VALUE is asserted in exactly one test** — `tests/test_engine_version.py::TestRequiredEngineVersion::test_pinned_floor_is_current` hardcodes the tuple with a per-bump comment trail — so every `REQUIRED_ENGINE_VERSION` bump edits that assertion in the same commit (add the bump's reason to its comment). Missed on 7.23.0: the unit leg of the battery red'd on it after the paired engine gate was already green.
+**Engine-service pin (conditional 8th target — nexus-3rq00).** The Python/Java boundary rides one more hand-edited constant that sits OUTSIDE the seven-manifest parity gate: `PINNED_SERVICE_TAG` in `src/nexus/daemon/binary_install.py`, the `engine-service-vX.Y.Z` release this build auto-installs. It is DERIVED from `REQUIRED_ENGINE_VERSION`, so it is never hand-edited: moving the engine identity moves the pin by construction. Two invariants the `TestEnginePinParity` test enforces: (1) `PINNED_SERVICE_TAG`'s numeric version must be `>= REQUIRED_ENGINE_VERSION` (`src/nexus/engine_version.py`) — never ship a client that auto-installs an engine it then refuses as too old; (2) at the 6.0 release boundary the pin must be non-None (it is intentionally `None` pre-6.0). A release that bumps pyproject to 6.x without setting a real pin trips CI. **The pin's VALUE is asserted in exactly one test** — `tests/test_engine_version.py::TestRequiredEngineVersion::test_pinned_floor_is_current` — and since nexus-9gggv (2026-09-08) it is DERIVED, not typed: the floor must equal the first `engine-service-vX.Y.Z` the newest released `CHANGELOG.md` section names. So a `REQUIRED_ENGINE_VERSION` bump needs no test edit; it needs the release's CHANGELOG section to name its engine pairing as the FIRST `engine-service-v` mention in that section (a `was engine-service-vX` aside goes after the pairing, never before it; every released section to date satisfies this, 358 checked), and a bump without that line, or that line without the bump, is the red. Add the bump's reason to the test's comment trail for provenance. Before this derivation the tuple was hand-edited per release and missed on 7.23.0: the unit leg of the battery red'd on it after the paired engine gate was already green.
 
 Semver: MAJOR for breaking, MINOR for new features, PATCH for bug fixes.
 
@@ -463,7 +463,7 @@ Both must report `vX.Y.Z` / `X.Y.Z`. **Do not declare done before this check pas
 git checkout develop && git pull
 git merge origin/main --no-edit    # trivially clean right after a release:
                                    # the release branch just CONTAINED develop
-git push origin develop
+scripts/git-push-develop.sh HEAD   # the merge commit vouches for what it merged in (nexus-9wxu6)
 ```
 
 Why mandatory (2026-07-23 incident): from 6.12.0 through 6.17.0 no release

AGENTS.md

@@ -95,6 +95,7 @@ Pagination over a large collection: `limit ≤ 300` per call, `offset += 300` in
 - **`develop` release boundary LIFTED 2026-06-29** — release-blocker bead `nexus-luxe6` closed; conexus 6.0.0 (the migration-capable release) published from develop, and `develop` is releasable again. **RDR-155 P4b (the FINAL Chroma deletion) SHIPPED 2026-07-25** — the dependency is dropped (absent from `uv.lock`), `guided_upgrade_cmd.py`/`migrate_cmd.py` are deleted outright, and `nx guided-upgrade` no longer exists. Pre-PG installs redirect through a two-hop path: pin to the last migration-capable release, `conexus==6.18.1`, where `nx guided-upgrade` still runs (Chroma → PG17+pgvector, copy-not-move), then upgrade normally from there. Frozen Chroma directories left on disk are relics: nothing reads them and there is no path back to that era (Hal, 2026-08-29). Authoritative record: T2 `nexus/release-boundary-since-p4a` (updated).
 - **Integration branch is `develop`.** Open PRs against `develop`, not `main`. `main` carries the plugin marketplace surface; the develop split protects it from in-flight churn. Releases promote `develop` to `main` via a PR-gated release branch (nexus-mkj6u) — there are NO direct-to-`main` commits at all (`docs/contributing.md` § Release Process). The plugin no longer ships a review-coverage push gate (deleted 2026-08-22, Sam's decision: self-attested, one true positive against denying correct pushes, and `develop` is already PR-gated to `main` with required checks so unreviewed code ships to nobody) — push-to-main protection and the `git add` wildcard redirect remain Hal's user-level hook (`~/.claude/hooks/nexus-git-policy.py`), personal workflow policy rather than a plugin behavior other conexus users inherit.
 - **Never `git add -A` or `git add .`.** Stage by explicit path so untracked drafts don't sneak in.
+- **Push `develop` only through `scripts/git-push-develop.sh <sha>...`** (nexus-9wxu6): it refuses unless `origin/develop..develop` equals the commits you name, so a peer's unpushed commits in the shared checkout never ride your push (four times on 2026-09-07). `NX_PUSH_SOURCE=HEAD` from a detached worktree pushes your commits without touching the local branch. Never `git commit --amend` in the primary checkout; the user-level hook denies it when HEAD is not this session's commit. See `docs/contributing.md` § Git Workflow.
 - **Never include AI attribution in commits.** No "Generated with Claude", no `Co-Authored-By: Claude`. Bead references and `Closes #N` only.
 - **Never delete RDR files.** Closing an RDR is a frontmatter `status: closed` flip — the file stays. See [`docs/rdr/AGENTS.md`](docs/rdr/AGENTS.md).
 - **Closed vocabularies (RDR status, and future ones) are CHECKED TABLES, not prose — see [`docs/rdr/AGENTS.md`](docs/rdr/AGENTS.md) § RDR lifecycle for the full story.** `src/nexus/tables/` (packaged, checked at load time); `docs/tables/` for repo-only tables (the release-choreography table both release gates resolve).
@@ -206,7 +207,7 @@ make nearly every cut a docs cut.
 
 The Java **engine-service** binary is a separate release artifact with its own cadence. Conflating it with the PyPI/marketplace release is how the cloud engine silently drifts behind develop (2026-06-26: 22 `service/` commits / 4 days un-deployed, un-cloud-tested).
 
-Build or test the engine through `scripts/mvnw-leased.sh` (never a bare `./mvnw`/`mvn`) — one builder at a time; a concurrent `./mvnw` invocation against the same `service/target` corrupts jOOQ codegen mid-build (nexus-c00dw, see `scripts/lib/build-lease.sh`). The lease lives in the git common dir, so every worktree shares it, and a live holder is waited for rather than refused (`NX_BUILD_LEASE_WAIT`, nexus-g6xpa): one engine build or suite per box. `scripts/build-gate-jar.sh` caches the stamped jar on the exact `service/` content, so a fresh worktree with an unchanged tree gets a copy instead of a nine-minute rebuild.
+Build or test the engine through `scripts/mvnw-leased.sh` (never a bare `./mvnw`/`mvn`) — one builder at a time; a concurrent `./mvnw` invocation against the same `service/target` corrupts jOOQ codegen mid-build (nexus-c00dw, see `scripts/lib/build-lease.sh`). The lease lives in the git common dir, so every worktree shares it, and a live holder is waited for rather than refused (`NX_BUILD_LEASE_WAIT`, nexus-g6xpa): one engine build or suite per box. `scripts/build-gate-jar.sh` caches the stamped jar on the exact `service/` content, so a fresh worktree with an unchanged tree gets a copy instead of a nine-minute rebuild. The Python suite reads the same lease at session start (nexus-pv93h): while a build holds it, `pytest` refuses the whole run with one line and exit 75 naming the holder, and `NX_BUILD_LEASE_WAIT=<seconds>` makes it wait instead; `NX_TEST_T2_SUBSTRATE=none` runs are never gated.
 
 - **Artifact + trigger:** an `engine-service-vX.Y.Z` git tag fires `engine-service-release.yml`, which builds + cosign-signs the 3 native binaries (linux-amd64, linux-arm64, mac-arm64 — mac-arm64 unsmoked, no Docker on GH macOS, nexus-4xf5m; mac-amd64/Intel is not a supported target). It publishes **nothing to PyPI** and is **NOT gated by the luxe6 / RDR-155-P4a develop release boundary** (the workflow header says so explicitly). **The release is a DRAFT until every asset is attached** (nexus-cl14i, after v0.1.95 published PG bundles with no binary): a final `promote-release` job flips it only when both matrices succeeded and all 21 assets are present, so a tag is consumable roughly 40 to 65 minutes after push, never partially; a failed leg, mac-arm64 included, leaves a draft that `gh run rerun --failed` completes and promotes. So the engine can be refreshed in the cloud at any time, independent of the unreleasable-develop state.
 - **Version is tag-stamped — there is NO manifest to bump.** `release.properties` `release_version` is blank in source and stamped at native-build time from the tag (the Maven `pom.xml` stays `1.0-SNAPSHOT`, the dev coordinate). The cut is NOT just suite-green-then-tag: the `engine-release` skill (Authority: this section) enforces a full pre-tag battery — full engine suite green on the tagged commit, `tests/e2e/migration-rehearsal/run.sh --shakeout` (must end `CANDIDATE SHAKEOUT PASSED`) — then human pushes `engine-service-vX.Y.Z`, followed by a post-publish `--acquire` gate against the published bytes. `scripts/check_client_release_precondition.py --engine-tag engine-service-vX.Y.Z` gates the **DEPLOY, never the tag cut** (Hal directive 2026-08-02 — its pre-tag wiring forced conexus 7.1.0 to ship pinned to a pre-fence engine, its own flagship feature inert on fresh local installs; a red exit means the deploy waits for the client tag carrying the listed commits, per the paired-release choreography below). **A tag gates DELIVERY, not work**: engine changes are fully testable end-to-end on develop (`scripts/mvnw-leased.sh test` + the Python suite's engine substrate + LSG against a `build-gate-jar.sh` dev jar) — "cannot deploy yet" is never "cannot do/test/tag it" (error recurred 3x: nexus-0ehwe thread 2026-07-31 twice, the 7.1.0/v0.1.62 inversion 2026-08-02). Use the `engine-release` skill as the executable checklist, not this summary.
@@ -297,7 +298,7 @@ clone (see `docs/contributing.md` § Step 0b KNOWN LIMITATION, nexus-2zmfw).
    ```
    git checkout develop && git pull
    git merge origin/main --no-edit   # trivially clean right after a release
-   git push origin develop
+   scripts/git-push-develop.sh HEAD   # the merge commit vouches for what it merged in (nexus-9wxu6)
    ```
    Skipping this is how develop drifts behind the release-only commits and the next release branch conflicts (2026-07-23 incident; `docs/contributing.md` step 11b).
 9. **Reinstall locally.** `scripts/reinstall-tool.sh && nx --version` — `pyproject.toml` is bumped, but the shim does not point at a wheel: it resolves `<tools>/current` at spawn time and execs the generation that pointer names, so until the reinstall flips `current` every new spawn lands in the old generation (and existing holders keep running from theirs afterwards).

CHANGELOG.md

@@ -6,6 +6,48 @@ Versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [7.36.1] - 2026-09-08
+
+Client-only patch. Engine unchanged at engine-service-v0.1.108
+(`REQUIRED_ENGINE_VERSION` 0.1.108); the wire ledger's Unshipped section is
+empty. Plugin pin advances to v7.36.1, which makes every entry that waited
+in `conexus/PENDING_RELEASE.md` since 7.36.0 live (see `conexus/CHANGELOG.md`).
+
+### Fixed
+
+- Service error bodies are redacted where they enter `VectorServiceError`
+  (new `nexus.redact` module), so `nx search`, `nx doc` and the doctor log
+  line no longer echo a rejected credential (nexus-8ooxn, nexus-hcy4w).
+- The upgrade-finish stamp (`last_seen_version`) is written only by a
+  managed install; a dev checkout on a release branch no longer makes the
+  next installed-tool invocation report an upgrade that never happened
+  (nexus-i24r4).
+- Session end reaps stale `t1_mint_<session>.lock` litter under
+  `~/.config/nexus` (older than a day, no live lease) as its own
+  failure-isolated step, instead of only under `nx doctor --fix`
+  (nexus-fjwk7).
+- Aspects: the cost banner names the measured model, usage is logged before
+  the envelope check, and an extraction refusal is reported as such
+  (follow-up to 7.36.0's aspects work).
+- `nx dt index` page-coverage follow-ups after review (nexus-i0cwh).
+
+### Developer workflow
+
+- `scripts/git-push-develop.sh <sha>...` is the way develop is pushed from a
+  shared checkout: it fetches, resolves the tip once, and pushes only when
+  `origin/develop..tip` equals the commits vouched on the command line; a
+  vouched merge commit covers what it merges in, so the release and
+  plugin-cut back-merges use it too (nexus-9wxu6).
+- The unit suite decides once at session start while a Maven run holds the
+  shared build lease: it refuses with exit 75 naming the holder, or waits
+  when `NX_BUILD_LEASE_WAIT=<seconds>` is set; `NX_TEST_T2_SUBSTRATE=none`
+  runs are never gated. The migration-rehearsal `--shakeout` native build
+  and the gc-ab harness wait on the lease like every other producer
+  (nexus-pv93h).
+- Release pins that moved by hand every cut are derived: the engine-floor
+  test reads the pairing from the newest released CHANGELOG section, and
+  the stale-dim-table count pins tally code lines only (nexus-9gggv).
+
 ## [7.36.0] - 2026-09-07
 
 Pairs with engine-service-v0.1.108 (additive).

conexus/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "conexus",
-  "version": "7.36.0",
+  "version": "7.36.1",
   "description": "Self-hosted three-tier knowledge management with plan-centric retrieval (nx_answer), specialized agents, semantic search, and RDR decision tracking for Claude Code.",
   "author": {
     "name": "Hal Hildebrand",

conexus/CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to the conexus plugin are documented here.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 Versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [7.36.1] - 2026-09-08
+
+Plugin version aligned with conexus 7.36.1. Everything below waited in
+`PENDING_RELEASE.md` since 7.36.0 and is live at this pin.
+
+- `pre_close_verification_hook.sh`: the close command is tokenized
+  quote-aware before it is split on operators, so a `;` or `do` inside a
+  quoted `--reason` no longer harvests prose ids (a session name, a peer's
+  bead) as close targets; with an unbalanced quote the flag value is
+  blanked before the raw-scan fallback (nexus-fv65m).
+- `rdr_hook.py` (SessionStart): collection existence is asked of the T3
+  client, not substring-matched against `nx collection list`; a resolution
+  failure is logged instead of swallowed; the T3 call has a 4 s deadline
+  inside the hook's 10 s cap; the summary counts every document the
+  indexer walks beside the RDR count (nexus-owna8). The text names
+  `nx index repo <root>` alone; `nx catalog setup` is retired.
+- Every example that said `collection="knowledge"` now names a subject
+  (`collection="<subject>"`) across 27 skills, agents, commands and the
+  reference, with the subject rule and a Common Mistakes row in
+  `using-nx-skills` (nexus-fjc8v): the placeholder had minted
+  `knowledge__knowledge__<model>__v1` with 1464 live chunks.
+
 ## [7.36.0] - 2026-09-07
 
 - `rdr-gate` skill and command: the outcome is computed by

conexus/PENDING_RELEASE.md

@@ -29,6 +29,6 @@ mechanize, it matters enough to ship.
 ---
 
 
-## Awaiting the next release or plugin cut (pinned: v7.36.0)
+## Awaiting the next release or plugin cut (pinned: v7.36.1)
 
 (none)

conexus/README.md

@@ -217,7 +217,7 @@ MCP tool directly and skip the agent spawn entirely.
 
 | Stub agent | Replacement | Call shape |
 |------------|-------------|------------|
-| knowledge-tidier | nx_tidy | `mcp__plugin_conexus_nexus__nx_tidy(topic=..., collection="knowledge")` |
+| knowledge-tidier | nx_tidy | `mcp__plugin_conexus_nexus__nx_tidy(topic=..., collection="<subject>")` |
 | plan-auditor | nx_plan_audit | `mcp__plugin_conexus_nexus__nx_plan_audit(plan_json=..., context="")` |
 | plan-enricher | nx_enrich_beads | `mcp__plugin_conexus_nexus__nx_enrich_beads(bead_description=..., context="")` |
 

conexus/agents/_shared/CONTEXT_PROTOCOL.md

@@ -383,13 +383,13 @@ All agents should:
 ### Storage Tools
 ```
 # Store a document
-mcp__plugin_conexus_nexus__store_put( content="content", collection="knowledge", title="research-topic-date", tags="category", agent="<your-role>"
+mcp__plugin_conexus_nexus__store_put( content="content", collection="<subject>", title="research-topic-date", tags="category", agent="<your-role>"
 
 # Search stored knowledge
 mcp__plugin_conexus_nexus__search( query="query", corpus="knowledge", limit=5
 
 # List stored documents
-mcp__plugin_conexus_nexus__store_list( collection="knowledge"
+mcp__plugin_conexus_nexus__store_list( collection="<subject>"
 ```
 
 ### Metadata